accept2close-nd(8)

NAME
accept2close-nd - trace process signals. Uses Linux SystemTap (non-debuginfo).

SYNOPSIS
accept2close-nd.stp [min_ms]

DESCRIPTION
This traces socket duration from the accept() syscall to close(), and provides details on the lifespan of these passive connections.

NOTE: This will miss sockets that are opened by one process, and then closed by another (eg, sshd).

REQUIREMENTS
SystemTap.

OPTIONS

min_ms
    Minimum lifespan threshold, in milliseconds. This is an optional argument that can be used to focus on outliers.

EXAMPLES

Trace all passive socket connections, and show event details and a summary:
    # accept2close-nd.stp

Trace all passive socket connections equal to or slower than 5 milliseconds:
    # accept2close-nd.stp 5

FIELDS

TIME
    Time of socket close, human readable.

PID Server process ID

COMM
    Server process name.

FD  File descriptor for socket.

DURATION
    Duration of socket connection (lifespan), in milliseconds.

OVERHEAD
Should be low. Test first.

SOURCE
This is from the SystemTap lwtools collection.

    https://github.com/brendangregg/systemtap-lwtools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool.

OS
Linux

STABILITY
Unstable - in development.

AUTHOR
Brendan Gregg

SEE ALSO
strace(1)